Connect an AWS Account

CloudBurn Platform scans your AWS account through a read-only IAM role you deploy in your own account, and writes scan results to a results bucket you own. CloudBurn never holds long-lived credentials for your account, and the durable copy of your findings lives only in your S3 bucket — CloudBurn reads from it to render your dashboard rather than keeping its own store of your scan data.

Connections belong to your workspace: every member can scan a connected account, and workspace owners and admins can add, verify, rename, and remove connections.

What you deploy

The connection consists of three pieces, all created in your account from a template the dashboard generates for you:

• A read-only IAM role, CloudBurnReadOnlyRole, that CloudBurn assumes to run discovery. It uses the AWS managed ReadOnlyAccess policy, plus write access scoped to the results bucket.
• An S3 results bucket, owned by you, where scan output is stored
• An AWS Resource Explorer index and default view in the chosen region — discovery uses Resource Explorer to enumerate resources. You can leave this out if the region already has one.

Setup steps

From AWS Accounts in your dashboard, choose Add AWS account (the form opens automatically when you have no accounts yet):

1. Enter the 12-digit AWS Account ID and, optionally, a Friendly name so teammates recognize the account. CloudBurn checks the account as soon as the ID is complete.
2. If the CloudBurn role is already installed in that account — for example, a teammate deployed it earlier — the dashboard reports Existing connection found, and Connect account adopts and verifies it in one step. You can go straight to scanning.
3. Otherwise the dashboard reports Connection setup required. Choose Continue setup to open the setup dialog, then deploy in one of two ways:
   • Copy a template. Pick the CloudFormation or Terraform tab, copy the template (or expand Preview template first), and deploy it through your own IaC pipeline. Both templates create the same resources.
   • Deploy directly. Pick the AWS Region where the integration should live, decide whether to keep Set up AWS Resource Explorer on, and choose Deploy directly through AWS Console. This opens the CloudFormation quick-create flow in a new tab with the template preloaded. Turn the Resource Explorer toggle off if the region already has an index and default view.
4. Once the deployment finishes, return to the dialog and choose Verify connection. CloudBurn checks role access, results storage, and resource discovery before the account can be scanned.

The setup dialog also notes that Lambda memory recommendations depend on AWS Compute Optimizer enrollment. CloudBurn does not enroll the account for you, so that check stays unavailable until AWS returns recommendation data.

Reading the account list

Connected AWS accounts shows every connection with its region and a Scan readiness status:

The row menu offers Verify all to re-run every check, and Rename to change the friendly name. If CloudBurn later loses the ability to assume the role (for example, after the stack is modified), the account shows Role access lost and scans pause until you verify the connection again.

Removing a connection

Deleting a connection in the dashboard removes CloudBurn's record of it — it does not delete the IAM role, CloudFormation stack, Terraform resources, or S3 bucket from your AWS account. Remove those through the same mechanism you deployed them with (delete the stack, terraform destroy, or manual cleanup) once you no longer need them.

What's next